Google’s Universal Cart Is Live. Here’s the Checklist to Make Sure Agents Can Actually Check Out on Your Store

At Google Marketing Live on May 20, 2026, Universal Cart stopped being a demo. Google announced that shoppers can now save products across retailers and check out - with Google Pay or the retailer's own flow - directly inside Search, AI Mode, the Gemini app, and YouTube shopping ads. The launch list is not a pilot: Nike, Sephora, Target, Walmart, Wayfair, and Shopify merchants like Fenty and Steve Madden, with Affirm and Klarna wired in for financing and hotels and food delivery slated next.

The plumbing under all of it is UCP (Universal Commerce Protocol) - the open standard that gives an AI agent a machine-readable entry point to a store at /.well-known/ucp. (Quick disclaimer: UCP is owned and maintained by Google and Shopify. UCPtools, which I work on, is an independent community tool - not affiliated with either.)

Here is the part that matters for everyone not named in that launch list: the agent decides in milliseconds whether your store can transact. There is no "almost." Either your UCP profile answers the questions the agent asks, or the agent moves on to a merchant whose profile does. No bounce shows up in your analytics. You just quietly stop existing in the one shopping surface that is about to matter most.

So this is the readiness checklist. It maps to the four things a validator actually checks, in the order an agent hits them.

Level 1: Structure - does the profile parse at all?

Before anything semantic, the profile has to be a well-formed UCP document served correctly. This is where most "it's there but it doesn't work" failures live.

• /.well-known/ucp returns 200 with Content-Type: application/json - not text/html, not a redirect to a marketing page.
• The root ucp object exists. Missing it is UCP_MISSING_ROOT and the agent has nothing to read.
• A version field is present and formatted YYYY-MM-DD. A stray semver string trips UCP_INVALID_VERSION_FORMAT.
• The JSON is valid - no trailing commas, no CDN error page wrapped around it.

Sounds trivial. It is the single most common break, because the file is served by a platform or a CDN that nobody is watching, and a caching plugin or a security challenge can turn a clean profile into an HTML error page overnight.

Level 2: Rules - is it actually UCP-compliant?

A parseable profile can still be semantically wrong in ways that make an agent distrust it. Level 2 is the UCP compliance layer.

• Namespace and origin match. The namespace your capabilities declare has to bind to the origin serving the profile. A mismatch is UCP_NS_ORIGIN_MISMATCH - a classic copy-paste-from-staging bug.
• Every endpoint is HTTPS, no trailing slash. UCP_ENDPOINT_NOT_HTTPS and UCP_ENDPOINT_TRAILING_SLASH are both hard stops; agents will not POST a payment intent over http:// or to a sloppy URL.
• No orphaned extensions. Every extension has to chain back to a capability that declares it. A dangling one is UCP_ORPHANED_EXTENSION and signals a profile that was hand-edited and never re-validated.
• Signing keys are present. UCP_MISSING_SIGNING_KEYS is the one that quietly kills checkout: without published keys, the agent cannot verify that the offer and the payment handler are really yours. It will browse and then refuse to transact.

That last one is the difference between showing up in Universal Cart's discovery layer and actually completing a purchase in it. Discovery without signing keys gets you window-shopped, not bought.

Level 3: Network - do your references actually resolve?

Your profile points outward - to capability schemas and handler endpoints. Level 3 fetches them, the way an agent would, from outside your network.

• Every referenced capability schema is reachable and self-describing. A schema host that 404s or times out is UCP_SCHEMA_FETCH_FAILED, and it is someone else's outage becoming your broken profile.
• Handler endpoints respond from the public internet, not just from inside your VPC. A check that runs on your own infra can hit a warm cache and report healthy while real agents get a connection error.
• TLS is valid across every edge, not just your origin. Certs renew and propagate unevenly; one stale CDN edge is enough to fail the agent that lands on it.

You cannot fully test Level 3 from a unit test, because the failures are environmental and external. This is the level that needs to be checked against your live domain, from outside.

Level 4: SDK - does it pass the official compliance pass?

The top level runs your profile through @ucp-js/sdk, the official UCP compliance kit. This is the closest a check gets to "would Google's own agent accept this?" - the same library the ecosystem builds against, applied to your live profile. Passing Levels 1 through 3 and failing here usually means a subtle shape mismatch the schema rules did not catch. If you only automate one gate, make it this one, because it is the one that tracks the spec as it evolves.

Run the whole checklist in one call

You do not have to eyeball any of this. UCPtools exposes a remote endpoint that fetches your live profile and runs all four levels server-side, the way an agent sees it:

curl -sS -X POST https://ucptools.dev/v1/profiles/validate-remote \
  -H "Content-Type: application/json" \
  -d '{"domain":"mystore.com"}' | jq

{
  "ok": false,
  "profile_url": "https://mystore.com/.well-known/ucp",
  "score": 72,
  "grade": "C",
  "issues": [
    { "severity": "error", "code": "UCP_MISSING_SIGNING_KEYS",
      "path": "$.ucp", "message": "No signing keys published",
      "hint": "Publish your Ed25519/ES256 public keys so agents can verify offers." }
  ],
  "validated_at": "2026-06-13T10:00:00Z"
}

Wire that same check into CI with the ucp-validate-action so a regression fails the build before it ships:

- uses: Nolpak14/ucp-validate-action@v1
  with:
    domain: 'mystore.com'
    min-score: 90

Where each stack tends to break

The checklist is platform-agnostic - it reads the open standard, not platform internals - but the failure that actually bites you tends to cluster by stack:

• Shopify: you are largely along for the ride on what the platform serves at the well-known path, which is good until a platform change shifts the manifest shape under you. Validate after every theme or app change, because you do not control that surface directly.
• WooCommerce: the usual culprit is a caching or security plugin that starts serving /.well-known/ucp from cache, behind a challenge, or as text/html. That is a Level 1 break (Content-Type) hiding behind a green admin dashboard.
• BigCommerce / headless: a frontend deploy moves a handler endpoint the profile still advertises, and Level 3 starts failing while the storefront looks perfect to a human. Storefront-scope mismatches show up here too.
• Custom / self-hosted: signing-key drift. The key rotates in your infra but not in the published profile, and UCP_MISSING_SIGNING_KEYS or a verification failure silently downgrades you from "can transact" to "can only be browsed."

In every case the break is invisible to a human visitor and only shows up when something fetches the live profile from outside and runs the checks. That is the entire argument for validating continuously instead of once.

The thing the launch list quietly proves

The brands Google named did not get into Universal Cart by accident. Someone on each of those teams treated the UCP profile as production infrastructure - versioned, validated, and monitored - not as a one-time SEO chore. That is the whole gap. The standard is open and the endpoint is a static file; nothing stops a mid-sized Shopify or WooCommerce store from being exactly as agent-ready as Nike. What stops most of them is that nobody ever validated past "the file exists."

Universal Cart going live is the forcing function. Agents are transacting now, in surfaces real shoppers already use every day. Run the checklist against your store - validate it free at ucptools.dev - and if it passes, set up monitoring so it stays passing at 3am when a cert renews and no one shipped a thing. The merchants who win this transition treat their UCP profile like uptime, because for agentic checkout, that is exactly what it is.

UCP is an open standard by Google and Shopify. UCPtools is an independent community tool. Built by Peter at UCPtools.